<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Nginx IP 访问控制完全指南</title>
    <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/6.4.0/css/all.min.css">
    <link rel="stylesheet" href="https://cdn.staticfile.org/tailwindcss/2.2.19/tailwind.min.css">
    <link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;700&display=swap" rel="stylesheet">
    <script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
    <style>
        body {
            font-family: 'Noto Sans SC', Tahoma, Arial, Roboto, "Droid Sans", "Helvetica Neue", "Droid Sans Fallback", "Heiti SC", "Hiragino Sans GB", Simsun, sans-serif;
        }
        .serif-font {
            font-family: 'Noto Serif SC', serif;
        }
        .gradient-bg {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
        }
        .card-hover {
            transition: all 0.3s ease;
        }
        .card-hover:hover {
            transform: translateY(-5px);
            box-shadow: 0 20px 40px rgba(0,0,0,0.1);
        }
        .code-block {
            background: #1e293b;
            border-radius: 12px;
            overflow: hidden;
        }
        .code-header {
            background: #334155;
            padding: 8px 16px;
            font-size: 14px;
            color: #94a3b8;
        }
        pre {
            margin: 0;
            padding: 20px;
            overflow-x: auto;
        }
        code {
            font-family: 'Consolas', 'Monaco', 'Courier New', monospace;
            color: #e2e8f0;
            line-height: 1.6;
        }
        .highlight-box {
            background: linear-gradient(135deg, #f3f4f6 0%, #e5e7eb 100%);
            border-left: 4px solid #6366f1;
            padding: 20px;
            border-radius: 8px;
            margin: 20px 0;
        }
        .section-number {
            display: inline-flex;
            align-items: center;
            justify-content: center;
            width: 36px;
            height: 36px;
            background: #6366f1;
            color: white;
            border-radius: 50%;
            font-weight: 600;
            margin-right: 12px;
        }
        .mermaid {
            display: flex;
            justify-content: center;
            margin: 40px 0;
        }
    </style>
</head>
<body class="bg-gray-50">
    <!-- Hero Section -->
    <section class="gradient-bg text-white py-20">
        <div class="container mx-auto px-6">
            <div class="max-w-4xl mx-auto text-center">
                <h1 class="text-5xl md:text-6xl font-bold mb-6 serif-font">
                    Nginx IP 访问控制
                </h1>
                <p class="text-xl md:text-2xl mb-8 opacity-90">
                    构建安全可靠的 Web 服务访问策略
                </p>
                <div class="flex justify-center space-x-6 text-lg">
                    <div class="flex items-center">
                        <i class="fas fa-shield-alt mr-2"></i>
                        <span>安全防护</span>
                    </div>
                    <div class="flex items-center">
                        <i class="fas fa-network-wired mr-2"></i>
                        <span>灵活控制</span>
                    </div>
                    <div class="flex items-center">
                        <i class="fas fa-tachometer-alt mr-2"></i>
                        <span>高效管理</span>
                    </div>
                </div>
            </div>
        </div>
    </section>

    <!-- Introduction -->
    <section class="py-16">
        <div class="container mx-auto px-6">
            <div class="max-w-4xl mx-auto">
                <div class="bg-white rounded-2xl shadow-lg p-8">
                    <p class="text-lg leading-relaxed text-gray-700">
                        利用 Nginx 实现基于 IP 的访问控制是一种常见的安全策略，用于限制或允许特定 IP 地址或 IP 段访问你的服务。本指南将深入探讨各种实现方式，帮助你构建完善的访问控制体系。
                    </p>
                </div>
            </div>
        </div>
    </section>

    <!-- Visual Architecture -->
    <section class="py-8">
        <div class="container mx-auto px-6">
            <div class="max-w-6xl mx-auto">
                <h2 class="text-3xl font-bold text-center mb-12 text-gray-800">访问控制架构概览</h2>
                <div class="bg-white rounded-2xl shadow-lg p-8">
                    <div class="mermaid">
                        graph TB
                            A[客户端请求] --> B{Nginx}
                            B --> C[IP 地址检查]
                            C --> D{访问规则}
                            D -->|Allow| E[允许访问]
                            D -->|Deny| F[拒绝访问]
                            E --> G[后端服务]
                            F --> H[返回 403]
                            
                            style A fill:#f9f,stroke:#333,stroke-width:2px
                            style B fill:#bbf,stroke:#333,stroke-width:2px
                            style G fill:#bfb,stroke:#333,stroke-width:2px
                            style H fill:#fbb,stroke:#333,stroke-width:2px
                    </div>
                </div>
            </div>
        </div>
    </section>

    <!-- Main Content -->
    <section class="py-16">
        <div class="container mx-auto px-6">
            <div class="max-w-5xl mx-auto">
                
                <!-- Section 1 -->
                <div class="mb-16">
                    <div class="flex items-center mb-8">
                        <span class="section-number">1</span>
                        <h2 class="text-3xl font-bold text-gray-800">允许或拒绝特定 IP 地址</h2>
                    </div>
                    
                    <div class="bg-white rounded-2xl shadow-lg p-8 card-hover">
                        <p class="text-lg text-gray-700 mb-6">
                            你可以通过在 Nginx 的配置文件中使用 <code class="bg-gray-100 px-2 py-1 rounded text-purple-600">allow</code> 和 <code class="bg-gray-100 px-2 py-1 rounded text-purple-600">deny</code> 指令来控制访问。常见的应用场景包括允许某些 IP 地址访问特定路径，或拒绝某些 IP 地址访问整个站点。
                        </p>
                        
                        <div class="code-block">
                            <div class="code-header">
                                <i class="fas fa-code mr-2"></i>nginx
                            </div>
                            <pre><code>http {
    server {
        listen 80;
        server_name toString.com;

        location / {
            # 允许特定 IP 访问
            allow 192.168.1.1;     # 允许单个 IP 地址
            allow 192.168.2.0/24;  # 允许某个 IP 段

            # 拒绝所有其他 IP 地址
            deny all;

            # 其他配置
            proxy_pass http://backend;
        }
    }
}</code></pre>
                        </div>
                        
                        <div class="highlight-box mt-6">
                            <h4 class="font-bold text-lg mb-3 text-gray-800">
                                <i class="fas fa-lightbulb text-yellow-500 mr-2"></i>配置解释
                            </h4>
                            <ul class="space-y-2 text-gray-700">
                                <li><i class="fas fa-check-circle text-green-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded">allow 192.168.1.1;</code> 允许 IP 地址 192.168.1.1 访问</li>
                                <li><i class="fas fa-check-circle text-green-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded">allow 192.168.2.0/24;</code> 允许 IP 地址范围 192.168.2.0 到 192.168.2.255 访问</li>
                                <li><i class="fas fa-times-circle text-red-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded">deny all;</code> 拒绝所有其他 IP 地址访问</li>
                            </ul>
                        </div>
                    </div>
                </div>

                <!-- Section 2 -->
                <div class="mb-16">
                    <div class="flex items-center mb-8">
                        <span class="section-number">2</span>
                        <h2 class="text-3xl font-bold text-gray-800">基于 IP 的访问控制应用于特定目录</h2>
                    </div>
                    
                    <div class="bg-white rounded-2xl shadow-lg p-8 card-hover">
                        <p class="text-lg text-gray-700 mb-6">
                            如果你只想控制对特定目录或文件的访问，可以将 <code class="bg-gray-100 px-2 py-1 rounded text-purple-600">allow</code> 和 <code class="bg-gray-100 px-2 py-1 rounded text-purple-600">deny</code> 指令应用到 <code class="bg-gray-100 px-2 py-1 rounded text-purple-600">location</code> 块中。
                        </p>
                        
                        <div class="code-block">
                            <div class="code-header">
                                <i class="fas fa-code mr-2"></i>nginx
                            </div>
                            <pre><code>http {
    server {
        listen 80;
        server_name toString.com;

        location /private {
            # 允许特定 IP 地址访问 /private 目录
            allow 192.168.1.1;
            allow 192.168.2.0/24;
            
            # 拒绝所有其他 IP 地址
            deny all;

            # 其他配置
            proxy_pass http://backend/private;
        }

        location / {
            # 其他请求的处理
            proxy_pass http://backend;
        }
    }
}</code></pre>
                        </div>
                    </div>
                </div>

                <!-- Section 3 -->
                <div class="mb-16">
                    <div class="flex items-center mb-8">
                        <span class="section-number">3</span>
                        <h2 class="text-3xl font-bold text-gray-800">限制访问频率（基于 IP 的流量控制）</h2>
                    </div>
                    
                    <div class="bg-white rounded-2xl shadow-lg p-8 card-hover">
                        <p class="text-lg text-gray-700 mb-6">
                            你可以结合 IP 访问控制和 Nginx 的限流功能，限制某个 IP 地址的访问频率，以防止恶意攻击或滥用。
                        </p>
                        
                        <div class="code-block">
                            <div class="code-header">
                                <i class="fas fa-code mr-2"></i>nginx
                            </div>
                            <pre><code>http {
    # 定义限流区域
    limit_req_zone $binary_remote_addr zone=mylimit:10m rate=1r/s;

    server {
        listen 80;
        server_name toString.com;

        location / {
            # 应用限流策略
            limit_req zone=mylimit burst=5;

            # 允许特定 IP 地址访问
            allow 192.168.1.1;
            deny all;

            # 其他配置
            proxy_pass http://backend;
        }
    }
}</code></pre>
                        </div>
                        
                        <div class="highlight-box mt-6">
                            <h4 class="font-bold text-lg mb-3 text-gray-800">
                                <i class="fas fa-lightbulb text-yellow-500 mr-2"></i>配置解释
                            </h4>
                            <ul class="space-y-2 text-gray-700">
                                <li><i class="fas fa-tachometer-alt text-blue-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded">limit_req_zone</code> 定义限流区域 mylimit，每个 IP 地址的访问速率限制为每秒 1 次</li>
                                <li><i class="fas fa-chart-line text-green-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded">limit_req zone=mylimit burst=5;</code> 允许短时间内突发 5 次请求，超出限制则会被延迟处理</li>
                            </ul>
                        </div>
                    </div>
                </div>

                <!-- Section 4 -->
                <div class="mb-16">
                    <div class="flex items-center mb-8">
                        <span class="section-number">4</span>
                        <h2 class="text-3xl font-bold text-gray-800">基于地理位置的访问控制</h2>
                    </div>
                    
                    <div class="bg-white rounded-2xl shadow-lg p-8 card-hover">
                        <p class="text-lg text-gray-700 mb-6">
                            如果你需要基于地理位置进行 IP 访问控制，可以结合 IP 地理位置库来实现。这需要安装额外的 Nginx 模块，如 <code class="bg-gray-100 px-2 py-1 rounded text-purple-600">ngx_http